13
3
My office PC restarts every Sunday at an unknown time for unknown reason. I wish to know when my PC restarts and most importantly reason for which it restarts. I suspect that there is a third party install that force PC to restart.
Could you let me know how to determine the date and time when the PC was restarted? My OS is Windows XP SP3.
Thanks.
xorpower
Posted 2013-03-04T07:22:19.973
Reputation: 1 629
26
To help diagnose the restart, what you should first check is Event Viewer.
Just enter eventvwr in the run dialog (which can be called by pressing Win + R).
Under Windows Logs > System look for events from the "Kernel-Power". This will also show if the system unexpectedly restarted by a blue screen and show events prior to it.
If it was a blue screen you can view the BSOD using BlueScreenView.
jay
Posted 2013-03-04T07:22:19.973
Reputation: 6 287
My OS is Windows XP and I don't see the options that you have pasted in screenshot (which is of Windows 8) – xorpower – 2013-03-04T10:07:25.790
sorry, it's a slightly different view: http://upload.wikimedia.org/wikipedia/en/f/f2/Windows_XP_Event_Viewer.png but practically the same
– jay – 2013-03-04T10:45:15.7174If the computer isn't a server, I tend to disable "Reboot on BSoD" so that I will always see it and know there's a problem. – Alvin Wong – 2013-03-04T12:18:23.163
2Windows XP has almost exactly the same options as he described. You might have to dig a bit, but it's all there :) – NickG – 2013-03-04T14:08:51.853
@jay: I see your attached snapshot. Which event ID tells the PC was shutdown/restarted? – xorpower – 2013-03-08T12:38:32.030
18
If you open a command prompt and type systeminfo, the command will spit out some data, including when it was last booted.
More info here.
Andrew Ferrier
Posted 2013-03-04T07:22:19.973
Reputation: 1 604
This command list down when the PC was restarted last. How to know when was the PC shutdown and the cause of it? – xorpower – 2013-03-04T10:05:10.160
2@romilnagrani - You asked how to tell if the computer was rebooted. This answer tells how to do exactly that. Shutdown event is different from the computer rebooting. – Ramhound – 2013-03-04T15:34:20.847
3
Windows 7, open up a command prompt and type:
systeminfo | find /i "boot time"
You will see a single line showing when the computer was last booted:
System Boot Time: 2/26/2013, 4:33:35 PM
OR
Windows XP open up a command prompt and type:
systeminfo | find /i "system up time"
You will see a single line showing how long the computer has been up:
4 Days, 15 Hours, 31 Minutes, 36 Seconds
David
Posted 2013-03-04T07:22:19.973
Reputation: 6 593
didn't show anything in my computer – user13267 – 2013-03-05T00:56:29.240
Try systeminfo | find /i "system up time" instead. On my computer it reports: 4 Days, 15 Hours, 31 Minutes, 36 Seconds – Adrian Pronk – 2013-03-05T09:07:51.383
I've confirmed that the top command works on my PC, and your command returns no result, Maybe it's an OS difference? I'm running 7. – David – 2013-03-05T17:57:01.897
@Jikag: And I'm running XP – Adrian Pronk – 2013-03-06T02:51:22.767
@AdrianPronk I have updated my answer to reflect your comments – David – 2013-03-06T16:43:18.797
2
It's likely it could be Windows Updates set to install on a Sunday night. Open Windows Update from the start menu and check the settings for when it is set to restart.
NickG
Posted 2013-03-04T07:22:19.973
Reputation: 1 102
2
net statistics server
Entering this in the command prompt will give you the time the OS was started. From there, you can cross-reference with the Event Viewer to see what occurred before this time.
Bigbio2002
Posted 2013-03-04T07:22:19.973
Reputation: 3 804
mm/dd/yyyy format should be illegal, and users and dealers be booked into rehab or shot. Normally the most significant digit of numbers is on the left, each digit becoming less significant until the least significant digit on the right. E.g. we learned Hundreds, Tens, Units in grade 1 at school. 123 is 1 hundred, 2 tens, plus 3 units. In many civilised countries, dates are the same, i.e. yyyy on the left, then mm then dd. – Reversed Engineer – 2018-06-27T07:02:10.120
In some places, at least they have dd/mm/yyyy (days are less significant than months, which are less significant than years). However, in some barbaric lands, they still put the least significant digits in the middle (dd), then mm on the left, then the most significant yyyy on the right. Prision or hanging I say :) – Reversed Engineer – 2018-06-27T07:04:40.810
1or net stats workstation. Remember, it reports the date in mm/dd/yyyy format which can be confusing. – Adrian Pronk – 2013-03-05T09:09:40.063
@AdrianPronk: It seems to report using whichever date/time format you've specified in Control Panel. – Karan – 2013-03-13T02:08:53.553
@karan: I have dd/MM/yyyy specified in control panel but still get the date displayed in mm/dd/yyyy format – Adrian Pronk – 2013-03-13T09:01:21.300
@AdrianPronk: net stats workstation just gave me "Statistics since 13-03-2013 11:09:10 PM". Pretty sure that's dd-MM-yyyy. Just saw that the question's about XP, so is that what you're still using? My results are from Win7. – Karan – 2013-03-13T18:14:35.647
1
You can see the NIC elapsed time since last time your computer was turned on | reboot at control panel-Network-Active Network by clicking on LAN
Juan Manuel Espinosa G.
Posted 2013-03-04T07:22:19.973
Reputation: 11
One way is to use a video camera to record the screen on Sunday. There is a chance that the responsible program will perform actions which may be observable on the screen. – Alvin Wong – 2013-03-04T12:16:37.910